SecureAnyCloud
Deployment guide

Oracle DB 11g Express on Linux

Overview

Oracle Database 11g Express Edition (XE) is a free, lightweight edition of Oracle Database, suited to development, testing and small production workloads. It provides the same core SQL and PL/SQL engine as the full Oracle Database, with resource limits on CPU, memory and storage.

This SecureAnyCloud AMI from the AWS Marketplace delivers Oracle Database 11g XE on Linux, preinstalled and configured. This guide walks you through deployment and configuration.

What you get:

  • Oracle Database 11g Express Edition 11.2.0.2 (64-bit) installed at /u01
  • A preconfigured XE database service that starts automatically on boot
  • Oracle Listener preconfigured on port 1521
  • A dedicated oracle OS user for database access
  • Randomly generated SYSTEM user credentials
  • An OS package update script that keeps the system current
  • AWS CLI v2 for AWS service integration
  • Systems Manager Agent (SSM) for remote management
  • CloudWatch Agent for monitoring
  • Latest security patches applied at build time
  • 24/7 SecureAnyCloud support with a guaranteed 24-hour response SLA

Prerequisites

Before you launch this AMI, make sure you have:

  • An active AWS account
  • An active subscription to the Oracle Database 11g Express listing on AWS Marketplace
  • An EC2 key pair for SSH access
  • Familiarity with EC2 instance management and SSH

Recommended instance type: t3.medium (2 vCPU, 4 GB RAM) or larger. The minimum requirements are 1 vCPU, 1 GB RAM and 20 GB of disk space.

1

Launch the AMI

  • Open the AWS Marketplace and search for "Oracle Database 11g Express SecureAnyCloud".
  • Choose Continue to Subscribe, accept the terms, then choose Continue to Configuration.
  • Select your preferred Region and Software Version.
  • Choose Continue to Launch.
  • Choose Launch through EC2 for full control over the instance configuration.
  • Select your instance type (t3.medium is recommended).
  • Configure storage with a minimum of 20 GB gp3 for the root volume, plus the dedicated /u01 Oracle volume.
  • Configure your Security Group with the following inbound rules:

Port 22, protocol TCP, source Your IP: SSH access.

Port 1521, protocol TCP, source Your IP: Oracle Database Listener port.

Important: Restrict port 1521 to trusted application servers or your IP only. Do not open the Oracle Listener port to the public internet.

  • Select your EC2 key pair and launch the instance.
2

Connect via SSH

When your instance is running and has passed both status checks (2/2), connect to it over SSH:

ssh -i your-key.pem ec2-user@<public-ip-address>

To switch to the root user:

sudo su -

Important: Wait for the EC2 instance to reach 2/2 successful status checks before you connect. Early connection attempts can fail with permission denied errors while the instance is still initialising.

3

Verify the Oracle XE Service

The Oracle XE database service starts automatically on boot. As the root user, check its status:

service oracle-xe status

Expected output:

LSNRCTL for Linux: Version 11.2.0.2.0 - Production Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC_FOR_XE))) STATUS of the LISTENER ------------------------ Alias LISTENER Version TNSLSNR for Linux: Version 11.2.0.2.0 - Production Trace Level off Security ON: Local OS Authentication SNMP OFF Default Service XE Listener Parameter File /u01/app/oracle/product/11.2.0/xe/network/admin/listener.ora Listening Endpoints Summary... (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC_FOR_XE))) (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=127.0.0.1)(PORT=1521))) The command completed successfully
4

Connect with SQL*Plus

Switch to the oracle user and connect to the XE database with SQL*Plus:

sudo su - oracle sqlplus / as sysdba

Expected output:

SQL*Plus: Release 11.2.0.2.0 Production Copyright (c) 1982, 2011, Oracle. All rights reserved. Connected to: Oracle Database 11g Express Edition Release 11.2.0.2.0 - 64bit Production SQL>

Type EXIT to leave the SQL*Plus session.

5

Connect Remotely with SQL Developer

To connect to the database from an external tool such as SQL Developer, use the following connection settings:

  • Database Type: Oracle
  • Authentication Type: Default
  • Username: SYSTEM
  • Password: See the credentials file below
  • Connection Type: Basic
  • Hostname: Your instance public IP
  • Port: 1521
  • SID: XE
  • Service Name: XE

Note: To retrieve the SYSTEM user password, read the randomly generated credentials file at /stage/scripts/oracle-database-xe-config.log.

Server Components

Oracle Database 11g XE: version 11.2.0.2, installed at /u01.

Note: The automatic OS package update script can update component versions on first boot.

Filesystem Layout

The image uses the following mount points:

  • / (38 GB): Root filesystem
  • /boot (2.0 GB): Operating system kernel files
  • /u01 (20 GB): Oracle software installation directory

Key Oracle directories:

  • /u01/app/oracle: Oracle base directory
  • /u01/app/oracle/product/11.2.0/xe: Oracle XE software home
  • /u01/app/oracle/product/11.2.0/xe/network/admin: Listener and TNS configuration files
  • /u01/app/oracle/diag: Oracle diagnostic and alert log files

Managing the Oracle XE Service

The Oracle XE database runs as a system service and starts automatically on boot.

Check the service status:

sudo su - service oracle-xe status

Stop the database:

sudo su - service oracle-xe stop

Start the database:

sudo su - service oracle-xe start

Scripts and Log Files

All of the following files are in /stage/scripts:

  • initial_boot_update.sh: Updates the OS with the latest packages on first boot
  • initial_boot_update.log: Output log for the boot update script
  • oracle-database-xe-config.log: Oracle Database XE SYSTEM user credentials

On Startup

An OS package update script runs on first boot to bring the image fully up to date. To disable it, remove the script and its crontab entry:

rm -f /stage/scripts/initial_boot_update.sh crontab -e
# Delete the following line, save and exit: @reboot /stage/scripts/initial_boot_update.sh

Troubleshooting

Cannot connect via SSH

  • Verify that the instance has reached 2/2 status checks in the EC2 console.
  • Confirm that your security group allows inbound TCP port 22 from your IP.
  • Make sure you are using the correct key pair and connecting as ec2-user.

Oracle XE service fails to start

  • Check the service status: service oracle-xe status
  • Try starting the service again: service oracle-xe start
  • Review the listener log at /u01/app/oracle/diag/tnslsnr/<hostname>/listener/alert/log.xml.
  • Verify that no other process is using port 1521: netstat -tlnp | grep 1521

Database fails to start

  • Switch to the oracle user: sudo su - oracle
  • Connect with SQL*Plus: sqlplus / as sysdba
  • Check the instance status: SELECT STATUS FROM V$INSTANCE;
  • Try starting the database manually: STARTUP;
  • Check the available disk space: df -h /u01

Cannot connect remotely on port 1521

  • Verify that the Oracle XE service is running: service oracle-xe status
  • Confirm that your security group allows inbound TCP port 1521 from your IP.
  • Test connectivity: telnet <instance-ip> 1521
  • Check the listener.ora configuration at /u01/app/oracle/product/11.2.0/xe/network/admin/listener.ora.

Security Recommendations

  • Restrict port access. Allow port 1521 only from trusted application servers or specific IP addresses.
  • Change the default passwords. Update the SYSTEM and SYS user passwords immediately after your first login.
  • Use strong passwords. Make sure all database user passwords meet complexity requirements.
  • Enable auditing. Configure Oracle Database auditing to track access and changes.
  • Encrypt connections. Configure Oracle Net Services to use SSL/TLS encryption for client connections.
  • Limit OS access. Restrict SSH access to authorised administrators only.
  • Review user privileges. Remove unnecessary grants and follow the principle of least privilege.
  • Keep the system updated. Apply OS security patches regularly.

Support

If you have any issues with this product, contact SecureAnyCloud support:

  • Email: sales@secureanycloud.com
  • Website: secureanycloud.com
  • Support hours: 24/7 with a guaranteed 24-hour response SLA

Deploy on AWS

Launch Oracle Database 11g Express with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS

Launch Oracle DB 11g Express on Linux with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com